How do we stay PCI compliant when our techs take card payments in the field?

The most effective step is not storing card numbers anywhere in your business. Use the payment processing built into your field software, or an encrypted card reader that sends the data straight to the processor. When card data never lands on your equipment, the scope of what you have to protect shrinks dramatically.

The common failure is not technical. It is a card number written on a work order, typed into a notes field, or left on a voicemail. No firewall fixes that, so part of this is training your office and field staff on how not to create the problem.

Around the payment path we keep the network segmented so payment traffic is not sharing space with guest Wi-Fi or shop devices, enforce device management on the tablets that process payments, keep those devices patched, and help you complete the annual self assessment questionnaire your processor requires. Most contractors are handed that questionnaire, guess at the answers, and never look at it again. Wrong answers matter if a breach ever gets investigated.